                (first (condp = tag
                         "access"  (db/find-access-token {:client-id client-id :secret arg})
                         "refresh" (db/find-refresh-token-by-secret {:client-id client-id :secret arg})
-                        "grant"   (db/find-refresh-token-by-login {:client-id client-id :login arg})))]
+                        "login"   (db/find-refresh-token-by-login {:client-id client-id :login arg})))]
 
       {:client-id client_id
        :user-id user_id

  [client-id secret]
  (find-by-key [client-id "refresh" secret]))

(defn find-grant-token
  [client-id login]
  (find-by-key [client-id "grant" login]))

(defn purge-tokens
  []

                   :created-at (java.util.Date.)
                   :tag (if refreshing "refresh" "access")})]

    ;; refresh tokens are "aliased" as "login" in no-sql databases. they're reachable
    ;; by user's login and allow to avoid multiple refresh-tokens per client-user pair.

    (when refreshing
      (store! *token-store* [:client-id :tag :login] (assoc token :tag "login")))

    (if-let [result (store! *token-store* [:client-id :tag :secret] token)]
      (map->Token result)
